#!/bin/bash
set -e

echo "need run as root"

echo ''
echo "show dev info"
lsblk -o NAME,FSTYPE,MOUNTPOINT /dev/sda

echo '1. ======'
echo "encrypt /boot use luks1"

echo ''
echo "remount /boot as readonly"
mount -oremount,ro /boot

echo ''
echo "save /boot as /tmp/boot.tar"
install -m0600 /dev/null /tmp/boot.tar
tar -C /boot --acls --xattrs --one-file-system -cf /tmp/boot.tar .

echo ''
echo "unmount /boot (/boot/efi)"
umount /boot/efi
umount /boot

echo ''
echo "wipe data in /boot dev (/dev/sda2)"
#dd if=/dev/urandom of=/dev/sda2 bs=1M status=none

echo ''
echo "Format the underlying block device (/dev/sda2) to LUKS1"
cryptsetup luksFormat --type luks1 /dev/sda2

echo ''
echo "add /dev/sda2 to /etc/crypttab & open it as boot_crypt"
uuid="$(blkid -o value -s UUID /dev/sda2)"
echo "boot_crypt UUID=$uuid none luks" | tee -a /etc/crypttab
cryptdisks_start boot_crypt

echo ''
echo "get /boot uuid in /etc/fstab"
cat /etc/fstab | egrep -i 'uuid.*/boot\s'
uuid="$(cat /etc/fstab | egrep -i 'uuid.*/boot\s' | cut -d ' ' -f1 | cut -d '=' -f2)"
echo "get uuid: $uuid"

echo ''
echo "create ext4 in boot_crypt use uuid $uuid"
mkfs.ext4 -m0 -U $uuid /dev/mapper/boot_crypt

echo ''
echo "mount boot_crypt as /boot"
mount -v /boot

echo ''
echo "copy save boot.tar to /boot"
tar -C /boot --acls --xattrs -xf /tmp/boot.tar

echo ''
echo "mount /boot/efi"
mount -v /boot/efi

echo ''
echo '2. ======'
echo "enable cryptmount in grub2"

echo ''
echo "enable encrypt & update grub"
echo "GRUB_ENABLE_CRYPTODISK=y" >>/etc/default/grub
update-grub
tar xf grub.tar.gz
#./grub/sbin/grub-install -d ./grub/lib/grub/x86_64-efi /dev/sda
grub-install -d ./grub/lib/grub/x86_64-efi /dev/sda
cat /boot/grub/grub.cfg | grep cryptodisk

echo ''
echo "update iterations to a lower value to speed up decryption"
cryptsetup luksDump /dev/sda2
# update it twice so that it use first slot
cryptsetup luksChangeKey --pbkdf-force-iterations 300000 /dev/sda2
cryptsetup luksChangeKey --pbkdf-force-iterations 300000 /dev/sda2
echo "test passphrase"
cryptsetup luksOpen --test-passphrase --verbose /dev/sda2


echo ''
echo '3. ======'
echo "setup passwd for initramfs"

echo ''
echo "generate the shared secret for /dev/sda3"
mkdir -m0700 /etc/keys
( umask 0077 && dd if=/dev/urandom bs=1 count=64 of=/etc/keys/root.key conv=excl,fsync )

echo ''
echo "create a new key slot with that key file in /dev/sda3 to unlock it"
cryptsetup luksAddKey /dev/sda3 /etc/keys/root.key
cryptsetup luksDump /dev/sda3

echo ''
echo "update crypttab for /dev/sda3 to use new key slot"
sed -i "s/^\(sda3_crypt.*\)none.*$/\1 \/etc\/keys\/root.key luks,discard,key-slot=1/g" /etc/crypttab

echo ''
echo "generate the shared secret for /dev/sda2"
#mkdir -m0700 /etc/keys
( umask 0077 && dd if=/dev/urandom bs=1 count=64 of=/etc/keys/boot.key conv=excl,fsync )

echo ''
echo "create a new key slot with that key file in /dev/sda2 to unlock it"
cryptsetup luksAddKey /dev/sda2 /etc/keys/boot.key
cryptsetup luksDump /dev/sda2

echo ''
echo "update crypttab for /dev/sda2 to use new key slot"
sed -i "s/^\(boot_crypt.*\)none.*$/\1 \/etc\/keys\/boot.key luks,discard,key-slot=1/g" /etc/crypttab

echo ''
echo "add key file to conf-hook"
echo "KEYFILE_PATTERN=\"/etc/keys/*.key\"" >> /etc/cryptsetup-initramfs/conf-hook

echo ''
echo "set umask for initramfs"
echo UMASK=0077 >> /etc/initramfs-tools/initramfs.conf

echo ''
echo "re-generate initramfs"
update-initramfs -u

echo ''
echo "check permisson in initramfs"
stat -L -c "%A  %n" /initrd.img

echo ''
echo "check key file is included in initramfs"
lsinitramfs /initrd.img | grep "cryptroot"

echo '======'
echo "done"

